Only set cookie and save new sessions if modified

The ```{ generate:  ... }``` option –currently defaults to true– specifies whether the session should always be created, or only created if the session is not empty.

This generically allows the concept of a *login session* by only setting a cookie and persisting the session when the session is modified after the express-session middleware.

There's a lot going on between the issues senchalabs/connect#451 and senchalabs/connect#899 senchalabs/connect#822.  Some of the commits around these issues allowed passing in a function that controls when the session is created.  I didn't go that route because it seems better to attach the session instance to the request object and check if its been modified after ```req.end()```.  Let me know if I missed something.

Fixes #8